Hermes WebUI before 0.51.270 has a resource exhaustion weakness that allows unauthenticated remote callers to repeatedly hit the passkey options endpoint without completing an assertion. Each POST request creates a fresh challenge and writes it to a JSON challenge store file. Because the store can grow without bound, an attacker can cause the file to enlarge arbitrarily and trigger repeated disk and CPU usage, downing the service. This flaw is a classic example of the “Resource Exhaustion” weakness (CWE‑770).

The affected product is Hermes WebUI (vendor nesquena). Any installation running a version older than 0.51.270 is vulnerable.

The CVSS score of 6.9 denotes a medium‑to‑high severity. Attackers can exploit the flaw without authentication and from any remote location by sending a high volume of POST requests to the passkey/options endpoint. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the lack of authentication and the unlimited request allowance make successful exploitation likely in a motivated environment.